Add repository-wide CODEOWNERS for agent-skills maintainers - #108

… security

Merges the six commits WordPress/agent-skills trunk was ahead by:

- ac16175 Add wp-env skill for local WordPress development (WordPress#38)
- ad58e37 Add plugin security guidance for escaping and AJAX (WordPress#63)
- f2f6af2 Fix Plugin/Theme header detection in PHP docblocks (WordPress#103)
- e9c58d5 Adding reference to webMCP at Playground Skill (WordPress#105)
- 9f4a603 chore: refresh upstream indices (WordPress#92)
- f1bac1f Add repository-wide CODEOWNERS for agent-skills maintainers (WordPress#108)

Conflict resolutions:

shared/references/wordpress-core-versions.json
  Kept ours. api.wordpress.org/core/version-check/1.7 reports 7.1.2
  (checked 2026-09-27); upstream's WordPress#92 snapshot stops at 7.1.1. The
  Gutenberg index merged cleanly: both sides already carry v24.0.0, and
  v24.1.0 is still at rc.1.

skills/wp-project-triage/scripts/detect_wp_project.mjs
  Kept ours. The fork already fixed WordPress#103's bug with `^[\s*#]*`, which
  matches every header line upstream's `^\s*\*?\s*` does, plus `#`-led
  lines. The detect_plugins.mjs half of WordPress#103 merged cleanly; the fork had
  not fixed that file. Both detectors now report docblock, bare, and
  non-plugin fixtures correctly.

skills/wp-playground/SKILL.md
  Kept the fork's frontmatter (Use-when opener, 6.9 floor, GPL license)
  and folded WordPress#105's "WebMCP site tools" into the description. Took WordPress#105's
  browser-workflow routing bullet in the fork's markdown-link style; it
  also drops the "Blueprint Editor" claim, which website.md never covered.

Clean merges: website.md now routes existing-site work to the new
webmcp.md, mcp.md, and sites-api.md references (the WebMCP tool names
match packages/playground/mcp in WordPress/wordpress-playground);
security.md gains escaping contexts and AJAX handler rules. wp-env
arrives exactly as upstream wrote it and is conformed and corrected in
the next commit. CODEOWNERS names @WordPress/agent-skills-maintainers,
which does not resolve in this fork; kept for tree parity with upstream.

The harness is not expected to pass at this commit: wp-env is not yet in
the skill inventory and skills/ changed without a version bump. The
follow-up commits close both.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

This fork is maintained on its own and does not send changes upstream, so
two pieces of WordPress organization automation have no effect here:

- .github/CODEOWNERS, added by upstream WordPress#108, assigns every path to
  @WordPress/agent-skills-maintainers, a team that does not resolve in
  henryperkins/agent-skills.
- .github/workflows/props-bot.yml runs WordPress's contributor-credit bot
  on pull_request_target and issue_comment events.

Nothing else in the tree referenced either file. If a later upstream merge
edits one of them, resolve the modify/delete conflict by keeping the
deletion. The 1.12.0 release notes, not yet published, now describe the
removal.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>